---
name: Defender for Cloud Apps OAuth App Governance
description: Audits OAuth applications connected to the Microsoft 365 tenant through Defender for Cloud Apps app governance, flags high-risk consents and over-privileged apps, and recommends remediation actions.
---

# Defender for Cloud Apps OAuth App Governance

> **TL;DR:** This skill uses Microsoft Defender for Cloud Apps app governance to inventory every OAuth application consented to by users or admins, scores each by privilege level and risk signals, and produces a ranked remediation table to revoke or restrict dangerous OAuth consents.

## What does the Defender for Cloud Apps OAuth app governance audit cover?

OAuth app governance in Microsoft Defender for Cloud Apps provides visibility into every third-party application that has been granted delegated or application permissions by users or administrators in the Microsoft 365 tenant. Unchecked OAuth consent is a persistent attack vector: threat actors register convincing-looking apps and use consent phishing to obtain persistent access without credentials. The MDCA app governance module enriches each OAuth app record with Microsoft Threat Intelligence signals, usage patterns, and permission severity. This skill systematically reviews the full OAuth app inventory, identifies apps with high-privilege scopes (Mail.ReadWrite, Files.ReadWrite.All, full_access_as_user), cross-references against the publisher verification status and Microsoft Threat Intelligence flags, and produces an action list for the security team.

## When should you run this skill?

- "Audit OAuth apps with access to our tenant"
- "Find risky third-party OAuth consents"
- "Review app governance in Defender for Cloud Apps"
- "Prepare OAuth consent evidence for an IRAP assessment"
- "Detect consent-phishing compromised apps"
- "Find apps with mail read-write access"

## How this skill works, step by step

1. Open the Microsoft Defender portal → Cloud Apps → App governance → Apps
2. Export the OAuth app inventory (name, publisher, verified status, permissions, consent type, last used, users)
3. Classify each app by permission severity:
   - Critical: Mail.ReadWrite, Files.ReadWrite.All, full_access_as_user, Directory.ReadWrite.All
   - High: Mail.Read, Files.Read.All, Calendars.ReadWrite, Contacts.ReadWrite
   - Medium: User.Read.All, Group.Read.All, offline_access
   - Low: User.Read, profile, openid
4. Flag apps by risk signal: unverified publisher, Threat Intelligence alert, usage by fewer than 3 users (low-use high-priv), last used more than 90 days ago (stale)
5. Compute composite risk: Critical permission + unverified publisher = High; Critical permission + verified = Medium; High permission + unverified = Medium
6. For High or Critical risk apps, identify the consenting users and admin consent grants
7. Produce the ranked table below and recommend: Revoke (high risk, low usage), Restrict (limit to specific users), Verify (publisher unverified but in use), Approve (legitimate app, confirm in sanctioned catalogue)

## Output format

| App Name | Publisher | Verified | Top Permission | Risk Level | Users | Last Used | Recommendation |
| --- | --- | --- | --- | --- | --- | --- | --- |
| SalesHelper Pro | Unknown | No | Mail.ReadWrite | High | 2 | 2026-03-12 | Revoke |
| Docusign | Docusign Inc | Yes | Files.ReadWrite.All | Medium | 340 | 2026-06-20 | Approve, add to catalogue |

Summary:

- Total OAuth apps: N
- Critical risk: N
- High risk: N
- Unverified publisher: N
- Recommended for revocation: N
- Threat Intelligence alerts: N

## Scope and safety

Read-only — this skill does NOT:

- Revoke OAuth consent grants (use Microsoft Entra → Enterprise applications → Permissions to revoke)
- Block specific applications (configure block policy in MDCA App governance)
- Inspect message content or file data accessed by apps

## Licensing and permissions

### Licences and add-ons

| Capability used | Minimum licence |
| --- | --- |
| Defender for Cloud Apps app governance | Microsoft Defender for Cloud Apps (included in Microsoft 365 E5 or E5 Security) |
| Threat Intelligence enrichment for OAuth apps | Microsoft Defender for Cloud Apps (app governance add-on included in E5 Security) |

### Least-privilege roles

- Cloud App Security Administrator (read MDCA app governance inventory)
- Security Reader (read-only Defender portal access for app governance review)

### Microsoft Graph permissions (read-only)

- `Application.Read.All` — enumerate OAuth app registrations and their permission grants
- `DelegatedPermissionGrant.ReadAll` — read delegated consent grants issued by users
- `AuditLog.Read.All` — read consent events in the unified audit log

## Sources and compliance

- [App governance in Microsoft Defender for Cloud Apps (Microsoft Learn)](https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-manage-app-governance)
- [OAuth app policies (Microsoft Learn)](https://learn.microsoft.com/en-us/defender-cloud-apps/app-governance-app-policies-overview)
- Supports Essential Eight ML2 evidence for Control 2 (application control — OAuth consent governance)
- Pair with OAuth Consent Risk Audit (Microsoft Entra) for a full consent-phishing coverage picture
- Pair with MDCA Policy Coverage Audit to ensure an OAuth governance policy is active
- Output in Australian English